Docker-based graylog permissions

Question

I've the following docker-compose.yml (slightly altered, but copied from here):

version: '2'
services:
  mongodb:
    image: mongo:3
    volumes:
      - /storage/mongo_data:/data/db
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.6.1
    volumes:
      - /storage/es_data:/usr/share/elasticsearch/data
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    mem_limit: 1g
  graylog:
    image: graylog/graylog:3.0
    volumes:
      - /storage/graylog_journal:/usr/share/graylog/data/journal
    environment:
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - GRAYLOG_HTTP_EXTERNAL_URI=http://127.0.0.1:9000/
    links:
      - mongodb:mongo
      - elasticsearch
    depends_on:
      - mongodb
      - elasticsearch
volumes:
  mongo_data:
    driver: local
  es_data:
    driver: local
  graylog_journal:
    driver: local

The problem is that when I run it with docker-compose it fails, since both graylog and elasticsearch services don't have access to /storage/graylog and /storage/elasticsearch respectively. What I need to change is to do:

chmod 1000:1000 -Rv /storage/elasticsearch
chmod 1100:1100 -Rv /storage/graylog

on the host machine.

So two questions arise:

why is that?
how to handle it elegantly?

score 1 · Answer 1 · answered Mar 25 '19 at 09:45

1

Elasticsearch and Graylog both do not run as root inside their container.

That is the reason their user/group need access to the filesystem on the host if your mount that into the container.

answered Mar 25 '19 at 09:45

Jan Doberstein

69
1
3

Ok, thanks. How can I handle it in my docker-compose so it runs out-of-the-box? – Opal Mar 25 '19 at 09:46
it is not possible with docker to make that happen. – Jan Doberstein Mar 26 '19 at 10:26

score 0 · Answer 2 · answered Mar 28 '19 at 10:12

The compose file creates the volumes for the data, but the containers don't use them!

Original:

volumes:
  - graylog_journal:/usr/share/graylog/data/journal

Your changes:

volumes:
  - /storage/graylog_journal:/usr/share/graylog/data/journal

This creates the data directory in your host system and is in your hands.

Docker-based graylog permissions

2 Answers2